Windows Analysis Report
http://matamask-usaklog.godaddysites.com/

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: http://matamask-usaklog.godaddysites.com

{
    "risk_score": 3,
    "reasoning": "The script checks for the presence of certain browser features and, if they are not available, loads a polyfill script from a third-party domain. This is a common practice to ensure compatibility across different browsers and is not inherently malicious. However, the use of `document.write()` to inject the script is considered a legacy practice and could potentially cause issues in some cases."
}

"IntersectionObserver"in window&&"Intl"in window&&"Locale"in window.Intl||document.write(`\x3Cscript src="https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~locale.en-US">\x3C/script>`)

{
  "contains_trigger_text": true,
  "trigger_text": "A crypto wallet & gateway to blockchain apps",
  "prominent_button_name": "MetaMask Login",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Metamask"
  ]
}

```json{  "legit_domain": "metamask.io",  "classification": "known",  "reasons": [    "The brand 'Metamask' is known and its legitimate domain is 'metamask.io'.",    "The URL 'matamask-usaklog.godaddysites.com' does not match the legitimate domain.",    "The URL contains a misspelling of 'Metamask' as 'matamask', which is a common phishing tactic.",    "The use of 'godaddysites.com' as a domain host is suspicious for a known brand like Metamask, which typically uses its own domain.",    "The presence of extra words and hyphens in the URL is indicative of phishing."  ],  "riskscore": 9}
Google indexed: False